In computer programming, the term hooking generally refers to various techniques that are used to intercept function calls (or messages, events, etc.) passed between computer executables. The computer code that handles the interception is called a hook. Such interception can be used to augment the behavior of operating systems, applications, and/or other software components through separate software programs. For example, a software program can hook to a function call in a separate software program so that when the function call is executed, the software program can prevent the function from executing during run time, change the behavior of the function (e.g., by augmenting the function with additional code), or replace the function with a new function.
Various libraries and products have been developed to hook to public functions and/or events defined through application programmer interfaces (“APIs”). However, such products often only can hook to publicly exported functions (e.g., well-defined API functions). For example, library data files (e.g., byte code) often include export tables that define the public functions and provide address information for the public functions in the file. The hooking programs can use the export tables to identify the addresses of the publicly exported functions (which are, in turn, used to hook to the functions). However, internal functions are not defined in the export tables, so conventional hooking methods often have no easy way to determine the start addresses of the internal functions (or private functions) in the byte code. Further, because internal functions are not easily identifiable, the addresses of such internal functions may not be known at compile time of the program that needs to hook to the internal functions. It is often required for such programs to know the addresses of the internal functions at compile time for the programs to hook to the function.